Uncertain syntax for wildcard subject alt name under intermediate cert with name constraints

[nettnikl]

Not sure how to label this, sorry. Depending on the answer, this might be a feature request or a bug report.
I'm trying to create well formed and well behaved certificates under a custom CA + intermediate cert.

Wildcards are not meant to be used in the intermediate cert. (#8253)

But then, (how) can i achieve something like:

example.lan, *.example.lan  <- Cert
*.lan                       <- Intermediate (alternatively, better: example.lan, *.example.lan, example2.lan, *.example2.lan, ...)
*                           <- CA

I'd assume the CA has to have no nameConstraints.
But what to do with the intermediate then?

Allowing DNS:lan leads to: Certificate is NOT Trusted: validation failed: candidates exhausted: unsatisfiable DNS name constraint: malformed SAN *.example.lan
Allowing DNS:.lan leads to: Certificate is NOT Trusted: validation failed: candidates exhausted: malformed DNS name constraint: .lan
Allowing DNS:*.lan leads to: permitted subtree violation (by OpenSSL during creation)
Allowing DNS:example.lan leads to: Certificate is NOT Trusted: validation failed: candidates exhausted: unsatisfiable DNS name constraint: malformed SAN *.example.lan
Allowing DNS:example.lan + DNS:.example.lan leads to: Certificate is NOT Trusted: validation failed: candidates exhausted: unsatisfiable DNS name constraint: malformed SAN *.example.lan
Allowing DNS:example.lan + DNS:*.example.lan leads to: Certificate is NOT Trusted: validation failed: candidates exhausted: unsatisfiable DNS name constraint: malformed SAN *.example.lan

Are you sure we can/want to disallow wildcards in the constraints?

[alex]

cc: @woodruffw

[woodruffw]

@nettnikl DNS name constraints don't allow patterns like *.. If you want to allow arbitrary subdomains of a domain you can express the domain itself, per RFC 5280:

DNS name restrictions are expressed as host.example.com. Any DNS
name that can be constructed by simply adding zero or more labels to
the left-hand side of the name satisfies the name constraint. For
example, www.host.example.com would satisfy the constraint but
host1.example.com would not.

In other words, in your case, I think you want a DNS name constraint of just lan on your root or intermediate CA. If you do that, the rest should work.

[nettnikl]

In other words, in your case, I think you want a DNS name constraint of just lan on your root or intermediate CA. If you do that, the rest should work.

I did the following, what change do you propose @woodruffw ?

Allowing DNS:lan leads to: Certificate is NOT Trusted: validation failed: candidates exhausted: unsatisfiable DNS name constraint: malformed SAN *.example.lan

[alex]

Can you provide some code for us to run, it's a bit hard to guess at what the problem is without context.

[alex]

Oh, I think I see the problem: https://github.com/pyca/cryptography/blob/main/src/rust/cryptography-x509-verification/src/lib.rs#L159

DNSName doesn't allow a wildcard in the SAN. I think that needs to be a DNSConstraint?

[woodruffw]

DNSName doesn't allow a wildcard in the SAN. I think that needs to be a DNSConstraint?

DNSPattern, but yep!

Confirming limbo case here: C2SP/x509-limbo#385

I'll look into a fix tonight.

[nettnikl]

You guys are gold, thanks!